FortiOS and FortiManager Critical Flaws: 10 November Fix Versions

Published 12 November 2026 · Rathish Kumar, Invitty

On 10 November 2026 Fortinet published the advisories behind the hardening builds it shipped in late October. The two that matter most are CVE-2026-126253, a critical FortiOS OSPF flaw rated 9.3, and CVE-2026-126261, a FortiManager FGFM bug rated 9.0 that needs no login. Neither is known to be exploited yet. Move FortiGates to FortiOS 7.2.14, 7.4.13, 7.6.8 or 8.0.2, and FortiManager to its matching fixed release.

What Fortinet disclosed on 10 November

This was a two-step release. Help Net Security reported on 26 October that Fortinet had already pushed fixed firmware for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, while keeping the vulnerability details back until 10 November. Fortinet's CISO, Carl Windsor, said AI models found the flaws and people on his team confirmed them.

The PSIRT page now lists a long run of advisories dated 10 November, most of them for FortiManager and FortiAnalyzer. Trade sites disagree on the total and on how many are critical, so we are not going to quote a count. What we can say from Fortinet's own pages is that every advisory below was marked as not known to be exploited when it went up. The worry is the gap: fixed builds have been downloadable for about three weeks, and anyone can compare old and new firmware to find what changed.

Which FortiOS versions are affected, and what to install

For FortiGate owners, two advisories set the target version. FG-IR-26-267 (CVE-2026-126253) is the critical one. Fortinet describes it as an authentication bypass in the OSPF daemon that could let an unauthenticated attacker broadcast link state advertisements. Its CVSS vector is adjacent network, so the attacker needs a foothold on a connected segment rather than the open internet. FG-IR-26-270 (CVE-2026-126256) is a high-severity kernel out-of-bounds read and write, scored 7.4, that could lead to code execution through crafted packets.

A third FortiOS item is smaller but worth knowing. FG-IR-26-195 (CVE-2026-121530, medium) affects only 7.6.0 to 7.6.6. If administrators sign in through a remote RADIUS account with two-factor tokens, and the RADIUS server sends a second challenge after a wrong token, a user with read-only rights or above could get into the GUI with a bad token. 7.6.7 fixes it, so anyone going to 7.6.8 is covered anyway.

FortiSASE 26.3.1 was fixed on Fortinet's side in 26.3.2; older FortiSASE releases are listed for migration.

FortiManager is the box we would patch first

If you only read one advisory, make it FG-IR-26-275. CVE-2026-126261 is an authorisation flaw in FGFM, the protocol FortiGates use to talk to FortiManager. Fortinet says an unauthenticated attacker who can reach the FGFM port could run code or commands with crafted packets. It is network-reachable, needs no credentials and has no virtual patch. Fixed releases are FortiManager 7.2.9, 7.4.6, 7.6.8 and 8.0.1.

FortiManager and FortiAnalyzer also have a critical dmserver flaw, FG-IR-26-244 (CVE-2026-126229, 9.1). It needs an authenticated administrator, who could then reach other VDOMs with crafted HTTP requests. That matters to anyone running a shared FortiManager for several companies or branches. Fixed builds are 7.4.12, 7.6.8 and 8.0.2. Versions 7.2 and 7.0 have no fix and must move to a newer branch, so a FortiManager on 7.2.9 still carries this one.

We still see FortiManager VMs with their management interface published to the internet so a remote engineer can log in. If yours is one of them, close that today, before the upgrade. Put it behind the VPN and allow FGFM only from your FortiGates' addresses.

The upgrade order we follow

1. List every Fortinet device and its build. FortiGates, FortiManager, FortiAnalyzer and any HA pairs. Note which ones run OSPF, BGP or SD-WAN with dynamic routing.
2. Check the path. Fortinet's upgrade path tool shows the intermediate builds for your model. Skipping a required step is the most common way we see an upgrade go wrong.
3. Upgrade FortiManager and FortiAnalyzer first. They should run the same or a later release than the FortiGates they manage.
4. Back up each FortiGate configuration, then upgrade the edge firewalls, starting with sites that run dynamic routing.
5. Confirm afterwards that VPN tunnels, SD-WAN rules and log forwarding came back, and record the new build numbers.

For CVE-2026-126256 Fortinet lists an IPS virtual patch in the FMWP database (update 26.100). Treat that as cover for the days before your window, not as a reason to skip the upgrade. The OSPF and FGFM flaws have no virtual patch at all.

What this means for FortiCare renewals and 7.0 boxes in India

An upgrade like this exposes two budget problems. The first is support. Without current FortiCare on the device you cannot pull the new firmware from the support portal, and we regularly find a branch FortiGate whose contract lapsed a year ago because the renewal went to someone who has left. Our renewals desk can check contract dates against serial numbers and quote the renewal with a GST invoice.

The second is hardware stuck on FortiOS 7.0. There is no 7.0 fix for the OSPF flaw. If a model cannot run 7.2.14 or later, keeping it means running a known-vulnerable firewall at the edge, and that is a poor trade against the cost of a new unit. Our FortiGate page lists the current models we supply, and the firewall sizing guide helps you avoid buying a model that is too small for your users and threat inspection. If an upgrade reveals signs that a device was already tampered with, remember that CERT-In expects certain incidents to be reported within six hours of noticing them.

Questions we are hearing about the November Fortinet advisories

Next step

Send us your FortiGate and FortiManager serial numbers, or a screenshot of the FortiManager device list, and we will tell you which units are below the fixed builds, which need an intermediate step, and which have support contracts close to expiry. More on what we deploy is on our Fortinet brand page.

Sources

Facts in this post come from these pages, checked on the date of publication. Vendor advisories change, so check the advisory itself before you schedule work.

• Fortinet PSIRT advisory FG-IR-26-267
• Fortinet PSIRT advisory FG-IR-26-270
• Fortinet PSIRT advisory FG-IR-26-195
• Fortinet PSIRT advisory FG-IR-26-275
• Fortinet PSIRT advisory FG-IR-26-244
• Fortinet PSIRT advisory index
• Help Net Security: Fortinet patches critical FortiOS flaws found with AI help